Let safety audits use guard evidence beyond a narrow local window

[Widthdom]

Summary

Whole-file-read audit flags checkpoint/checksum manifest reads despite preceding size bounds, and traversal audit flags its own safe policy because EnumerationOptions is defined outside the narrow match window.

Audit IDs: R-18 and R-19. Reproduced with locally built cdidx v1.40.3 at 404db09489c305f17d94f37026e00564d3ac527a.

Existing issue relationship

Follow-up adjacent to closed #4312, #3929, and #3965's recipe guard/context work.

Expected behavior and PR scope

Audit guard evaluation should be container/dataflow aware enough to recognize directly controlling size/enumeration policies without broad suppression. One guard-evidence framework PR for these two recipes.

Implementation guide for Codex 5.6 sol xhigh

• Represent guard evidence structurally (same variable/receiver/container/control path) rather than increasing a fixed line window.
• Recognize bounded size-check→read and configured EnumerationOptions→enumeration relationships.
• Add unsafe positives lacking guards, guards on unrelated variables, inverted checks, and distant-but-related helpers.
• Expose accepted/rejected guard evidence in diagnostic metadata.
• Add focused positive/negative regression tests, run the full net8.0 and net9.0 suite, and add the required bilingual changelog.d/unreleased/ fragment.

Acceptance criteria

• The bounded current reads/traversals are no longer high-risk hits.
• Unguarded and unrelated-guard controls remain findings.
• Evidence matching is deterministic and scoped, not proximity-only.